CVE-2015-3658

The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.

• CWE-254

• http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
• http://support.apple.com/kb/HT204941Vendor Advisory
• http://support.apple.com/kb/HT204950Vendor Advisory
• http://www.securityfocus.com/bid/75492
• http://www.securitytracker.com/id/1032754
• http://www.ubuntu.com/usn/USN-2937-1
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.htmlVendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Jun/msg00004.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-03/msg00132.html
• http://support.apple.com/kb/HT204941Vendor Advisory
• http://support.apple.com/kb/HT204950Vendor Advisory
• http://www.securityfocus.com/bid/75492
• http://www.securitytracker.com/id/1032754
• http://www.ubuntu.com/usn/USN-2937-1

Published

Jul 3, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3650vmware-vmx.exe in VMware Workstation 7.x through 10.x before…
• CVE-2015-3653Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
• CVE-2015-3654Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
• CVE-2015-3655Cross-site request forgery (CSRF) vulnerability in Aruba Net…8.8
• CVE-2015-3656Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
• CVE-2015-3657Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5…
• CVE-2015-3659The SQLite authorizer in the Storage functionality in WebKit…
• CVE-2015-3660Cross-site scripting (XSS) vulnerability in the PDF function…
• CVE-2015-3661QT Media Foundation in Apple QuickTime before 7.7.7, as used…
• CVE-2015-3662QT Media Foundation in Apple QuickTime before 7.7.7, as used…
• CVE-2015-3663QT Media Foundation in Apple QuickTime before 7.7.7, as used…
• CVE-2015-3664QT Media Foundation in Apple QuickTime before 7.7.7 allows r…